feat(reverse_proxy): lb_retry_match now contains status field

caddytest/integration/forwardauth_test.go

@@ -190,7 +190,7 @@ func TestForwardAuthCopyHeadersAuthResponseWins(t *testing.T) {
 	// its own values. The backend must receive the auth service values.
 	req, _ := http.NewRequest(http.MethodGet, "http://localhost:9080/", nil)
 	req.Header.Set("Authorization", "Bearer token123")
-	req.Header.Set("X-User-Id", "forged-id")   // must be overwritten
+	req.Header.Set("X-User-Id", "forged-id")     // must be overwritten
 	req.Header.Set("X-User-Role", "forged-role") // must be overwritten
 	tester.AssertResponse(req, http.StatusOK, "ok")
 

modules/caddyhttp/matchers.go

@@ -1554,6 +1554,15 @@ func (mre *MatchRegexp) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
 // ParseCaddyfileNestedMatcherSet parses the Caddyfile tokens for a nested
 // matcher set, and returns its raw module map value.
 func ParseCaddyfileNestedMatcherSet(d *caddyfile.Dispenser) (caddy.ModuleMap, error) {
+	return ParseCaddyfileNestedMatcherSetWithFilter(d, nil)
+}
+
+// ParseCaddyfileNestedMatcherSetWithFilter is like ParseCaddyfileNestedMatcherSet
+// but accepts an optional filter function. For each directive name encountered in
+// the block, the filter is called first. If it returns true, the directive was
+// handled by the filter and is not treated as a matcher. If it returns false,
+// the directive is treated as a request matcher as usual.
+func ParseCaddyfileNestedMatcherSetWithFilter(d *caddyfile.Dispenser, filter func(name string, d *caddyfile.Dispenser) (bool, error)) (caddy.ModuleMap, error) {
 	matcherMap := make(map[string]any)
 
 	// in case there are multiple instances of the same matcher, concatenate
@@ -1562,8 +1571,17 @@ func ParseCaddyfileNestedMatcherSet(d *caddyfile.Dispenser) (caddy.ModuleMap, er
 	// instances of the matcher in this set
 	tokensByMatcherName := make(map[string][]caddyfile.Token)
 	for nesting := d.Nesting(); d.NextArg() || d.NextBlock(nesting); {
-		matcherName := d.Val()
-		tokensByMatcherName[matcherName] = append(tokensByMatcherName[matcherName], d.NextSegment()...)
+		name := d.Val()
+		if filter != nil {
+			handled, err := filter(name, d)
+			if err != nil {
+				return nil, err
+			}
+			if handled {
+				continue
+			}
+		}
+		tokensByMatcherName[name] = append(tokensByMatcherName[name], d.NextSegment()...)
 	}
 
 	for matcherName, tokens := range tokensByMatcherName {

modules/caddyhttp/reverseproxy/caddyfile.go

@@ -67,7 +67,10 @@ func parseCaddyfile(h httpcaddyfile.Helper) (caddyhttp.MiddlewareHandler, error)
 //	    lb_retries <retries>
 //	    lb_try_duration <duration>
 //	    lb_try_interval <interval>
-//	    lb_retry_match <request-matcher>
+//	    lb_retry_match {
+//	        <request-matcher>
+//	        status <codes...>
+//	    }
 //
 //	    # active health checking
 //	    health_uri          <uri>
@@ -323,14 +326,20 @@ func (h *Handler) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
 			h.LoadBalancing.TryInterval = caddy.Duration(dur)
 
 		case "lb_retry_match":
-			matcherSet, err := caddyhttp.ParseCaddyfileNestedMatcherSet(d)
-			if err != nil {
-				return d.Errf("failed to parse lb_retry_match: %v", err)
-			}
 			if h.LoadBalancing == nil {
 				h.LoadBalancing = new(LoadBalancing)
 			}
-			h.LoadBalancing.RetryMatchRaw = append(h.LoadBalancing.RetryMatchRaw, matcherSet)
+			condSet, matcherSet, err := parseRetryMatchBlock(d)
+			if err != nil {
+				return err
+			}
+			if condSet == nil {
+				condSet = new(RetryConditionSet)
+			}
+			if matcherSet != nil {
+				condSet.MatchRaw = matcherSet
+			}
+			h.LoadBalancing.RetryConditionsRaw = append(h.LoadBalancing.RetryConditionsRaw, condSet)
 
 		case "health_uri":
 			if !d.NextArg() {
@@ -1686,6 +1695,46 @@ func (u *MultiUpstreams) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
 	return nil
 }
 
+// parseRetryMatchBlock parses the lb_retry_match block, which may contain
+// standard request matchers alongside "status" directives.
+// It returns a RetryConditionSet (if status is present) and/or
+// a matcher set (from request matchers). If only matchers are present, the
+// condition set is nil (backward compatible with retry_match).
+func parseRetryMatchBlock(d *caddyfile.Dispenser) (*RetryConditionSet, caddy.ModuleMap, error) {
+	var condSet RetryConditionSet
+	var hasConditions bool
+
+	matcherSet, err := caddyhttp.ParseCaddyfileNestedMatcherSetWithFilter(d, func(name string, d *caddyfile.Dispenser) (bool, error) {
+		if name != "status" {
+			return false, nil
+		}
+		args := d.RemainingArgs()
+		if len(args) == 0 {
+			return false, d.ArgErr()
+		}
+		for _, arg := range args {
+			if len(arg) == 3 && strings.HasSuffix(arg, "xx") {
+				arg = arg[:1]
+			}
+			code, err := strconv.Atoi(arg)
+			if err != nil {
+				return false, d.Errf("bad status value '%s': %v", arg, err)
+			}
+			condSet.Status = append(condSet.Status, code)
+		}
+		hasConditions = true
+		return true, nil
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if hasConditions {
+		return &condSet, matcherSet, nil
+	}
+	return nil, matcherSet, nil
+}
+
 const matcherPrefix = "@"
 
 // Interface guards

modules/caddyhttp/reverseproxy/httptransport_test.go

@@ -129,11 +129,11 @@ func TestHTTPTransport_DialTLSContext_ProxyProtocol(t *testing.T) {
 	defer cancel()
 
 	tests := []struct {
-		name                    string
-		tls                     *TLSConfig
-		proxyProtocol           string
+		name                     string
+		tls                      *TLSConfig
+		proxyProtocol            string
 		serverNameHasPlaceholder bool
-		expectDialTLSContext    bool
+		expectDialTLSContext     bool
 	}{
 		{
 			name:                 "no TLS, no proxy protocol",
@@ -194,4 +194,3 @@ func TestHTTPTransport_DialTLSContext_ProxyProtocol(t *testing.T) {
 		})
 	}
 }
-